Most of us add browser extensions without much thought. A coupon finder, a PDF tool, a VPN, an ad blocker, a crypto wallet. They install in two clicks from an official store, and then they just sit there, helping. That convenience hides an uncomfortable fact: an extension you install is software you have invited to sit inside your browser, where almost everything you do online passes through it.
A good extension uses that access responsibly. A malicious one uses it against you. And they are not rare or hard to find. In October 2026 alone, researchers reported 16 malicious Firefox extensions impersonating popular crypto wallets to steal people's recovery phrases, part of a steady drumbeat of similar discoveries across Firefox, Chrome, and Edge.
This is not a reason to panic or to swear off extensions. It is a reason to understand what you are actually granting, and to pick up a few habits that make a bad one far less likely to cost you anything. No product required, just awareness.
Key takeaways
An extension can potentially read the pages you visit, the things you type (including passwords and crypto recovery phrases), your session cookies, and your browsing history, because that access is what extensions are built to have.
Malicious extensions are regularly found in official stores. In one October 2026 case, 16 Firefox add-ons impersonated Rabby and OKX wallets to intercept recovery phrases and private keys and send them to attacker servers (source).
They disguise themselves as useful tools: wallets, PDF utilities, VPNs, ad blockers, productivity helpers, even "security" add-ons. Looking legitimate in a store is not proof of safety.
Removing an extension does not undo what it already took. If a fake wallet captured your recovery phrase, your funds are at risk until you move them.
The best protection is simple and free: install few extensions, check what each one can access, get wallets and tools only from the official source, and review and remove what you do not use.
What an extension can see once you install it
To understand the risk, it helps to know what you are granting. When you add an extension and it asks to "read and change all your data on websites you visit," that is not a formality. It means the extension's code runs on the pages you open and can see and modify what is there.
In practice, a far-reaching extension can read the content of the pages you load, see what you type into forms, access the cookies that keep you logged in to your accounts, and watch which sites you visit. Legitimate extensions need some of this to do their job, a password manager has to see login fields, an ad blocker has to see page content. The problem is that the same access, in the wrong hands, is everything an attacker needs. There is no technical line between "read the page to help you" and "read the page to rob you." It comes down to who wrote the code and what they chose to do with it.
What malicious extensions actually do, in real cases
The recent research reads like a catalog of what that access enables. A few examples, all from extensions found in official stores:
They steal crypto. The 16 Firefox extensions in October cloned Rabby and OKX wallets. When a user went to import their wallet, the fake interface captured the recovery phrase and private key and sent them to the attackers, who can then drain the funds. It was a continuation of an earlier wave of 40 similar fake-wallet add-ons, with the operators simply rotating names and versions.
They steal your logged-in sessions. A separate Firefox extension posed as a tool to verify your identity before opening protected PDFs. In the background, it injected code into the real Google accounts page to steal session cookies, the tokens that keep you signed in, which can let an attacker into your account without your password.
They hijack where you go and watch what you do. Researchers found dozens of extensions posing as productivity or privacy tools that quietly monitored browsing, harvested data, and even silently swapped the page you were on for a destination the attacker chose. Fake "VPN" extensions routed people's traffic through servers the operators controlled.
They read your private conversations. One popular style-changing extension was caught intercepting every conversation users had with ChatGPT, Gemini, Claude, Perplexity, and other AI tools, and forwarding the full text to its maker. An "ad blocker" was found pulling remote instructions to collect browsing history, social profiles, and AI chats.
The through-line is that none of these announced themselves. They wore the costume of something helpful, and the harm happened silently in the background.
How they get onto your computer so easily
The uncomfortable part is that most of these were not sketchy downloads from a random site. They were listed in official extension stores, with normal-looking names, icons, descriptions, and reviews. The stores do screen submissions, but malicious developers work around the checks, and plenty of bad extensions get through, stay up for a while, and get removed only after researchers catch them. By then they may have thousands of installs.
Two tricks make them especially easy to fall for. First, impersonation: a fake wallet or tool copies the name and look of a real one, so searching the store for "Rabby" or "OKX" can surface a convincing clone right next to, or instead of, the genuine listing. Second, rotation: when one batch is taken down, the operators publish new copies under fresh names, so the problem never really ends with a single takedown.
So "I only install from the official store" is good practice, but it is not a guarantee on its own. It needs a couple of habits around it.
How to protect yourself
None of this requires a product. It requires a little deliberateness at the moments that matter.
Install as few extensions as you can live with. Every extension is a standing invitation into your browser, so the fewer you have, the smaller your exposure. Treat adding one as a small decision, not a reflex.
Check what it is allowed to access before you accept. The install prompt tells you what the extension can do. If a simple tool wants to "read and change all your data on all websites," ask whether it really needs that. A wallpaper changer does not need your banking pages.
Get wallets and important tools from the official source, not from a store search. For a crypto wallet especially, go to the project's real website and use its official link rather than typing the name into the extension store and clicking the first result, which is exactly where clones wait. The same goes for VPNs and security tools.
Be suspicious of extensions that handle money or identity. A fake wallet, a fake "verify your identity" PDF tool, or a free "premium" unlocker are high-value disguises. Slow down before granting one access to anything sensitive.
Review your extensions regularly and remove what you do not use. Open your browser's extensions page every so often. Remove anything you do not recognize or no longer need. An extension you forgot about is still running with whatever access you once gave it.
If you think you installed a bad one, act like it already took what it could reach. Remove it, run a reputable security scan, and change passwords for accounts you use in that browser. If a fake crypto wallet ever saw your recovery phrase, treat that wallet as compromised: create a new one on a clean device and move your assets immediately, because removing the extension does not claw back a phrase that already left.
Where Haven fits, honestly
We will be straight about this, because it is an education piece, not a sales pitch: Haven is itself a browser extension, and it is not an antivirus for other extensions. It does not scan the Chrome or Firefox store and certify which add-ons are safe, and if a malicious extension is already running with broad access, removing it and securing your accounts is the real fix, not a browser tool.
Where Haven does help is the step several of these attacks depend on, the fake page. Many malicious extensions, and the ads and search results that promote them, funnel people to counterfeit wallet, login, and "verification" pages to harvest credentials and recovery phrases. Haven checks whether the page in front of you is really who it claims to be and flags impersonated wallet and login pages before you enter anything, which is the same thing that protects you against the phishing side of this whole ecosystem. On the business side, we have written separately about how malicious extensions steal enterprise logins and why MFA does not stop it, where Haven for Business can also limit what extensions reach on sensitive company systems.
But for an individual, the honest headline is the boring, durable one: the strongest protection against a malicious extension is not installing it, and keeping the ones you do install few, trusted, and reviewed. We have made the same point about convincing fakes in general in why modern phishing no longer looks like phishing and about fake crypto tools specifically in the COLDCARD wallet phishing scam.
An extension is a guest you give the run of your browser. Most are fine. The handful that are not can do a lot of damage quietly, so it is worth being a careful host.
About Haven
Haven is a browser extension that helps people make safer trust decisions online, before a scam can cost anything. It works at the moment someone is about to click a link or enter a password, flagging fake and impersonated login pages, suspicious links, and look-alike sites. Rather than only checking a page against a list of known-bad sites, Haven analyzes the actual page in front of the user, so it can catch brand-new and convincing fakes that other tools miss.
Haven is free for individual use. For teams, Haven for Business extends this browser-level protection across every employee.
